Here's a little-known but very useful no-brainer to add to your ASP.NET application's base Page.

void Page_Init (Object sender, EventArgs e)
{
   if (User.Identity.IsAuthenticated)
      ViewStateUserKey = User.Identity.Name;
}

"What this does is key the view state to an individual using a unique value of your choice.  This option, which is only available in ASP.NET 1.1, is the Page.ViewStateUserKey. This needs to be applied in Page_Init because the key has to be provided to ASP.NET before view state is loaded."

For more good details on preventing tampering and best-practices with ASP.NET, visit Anil John's page on Authentication/Authorization and Defense in Depth.